POST-QUANTUM CRYPTOGRAPHY / ADVISORY

PQC migration: inventory, pilots, and governance

Post-quantum cryptography migration

From threat models and cryptographic inventories to architecture and pilot validation. Turn post-quantum standards into actionable migration decisions.

Content reviewed: 2026-10-04

01 / EXPERT TEAM

Research depth. Practical judgment.

Meet the people through their expertise, academic backgrounds, and public research.

Chung-hao (Frank) Hsu

PQC projects & engineering research

Chung-hao (Frank) Hsu

EudTech project lead / technical contact

FPGA · Cryptographic migration planning · Audio steganography research

Research interests also include formal logic and abductive reasoning (IBE), connecting assumptions and inference to testable technical judgments.

EudTech team profile
Hung-Jr Shiu

Cryptography & algorithms

Hung-Jr Shiu

Ph.D. in Electrical Engineering, National Taiwan University

Assistant Professor, Computer Science and Information Engineering, National Taipei University

Research covers cryptography, algorithms, steganography, and multimedia security, including a principal-investigator role in ML-DSA implementation research.

University research profile

SELECTED RESEARCH / HUNG-JR SHIU

FIPS 204 ML-DSA signature implementation

2026 · Principal investigator · Pipelined HLS implementation

Connect algorithm standards to implementation research, including performance and engineering constraints.

View the university research project

Academic and research information links to original sources. University affiliations are individual credentials, not institutional endorsement of this service.

Plan around NIST standards

Algorithm references, not service certification

ML-KEMFIPS 203 · Key establishmentML-DSAFIPS 204 · Digital signaturesSLH-DSAFIPS 205 · Digital signatures

02 / SERVICES & DELIVERABLES

Reviewable deliverables at every stage.

Turn an unknown scope into a decision-ready inventory.

Start with one business service or agreed asset scope. Identify cryptographic use, confidentiality needs, and vendor dependencies.

Your deliverables

  • Threat model and cryptographic inventory
  • Data lifetime and priorities
  • Vendor support and gap assessment
  • Phased migration roadmap

AcceptanceEach asset has a traceable source, owner, and status. Uncovered areas remain explicit.

Readiness assessment · Turn an unknown scope into a decision-ready inventory.

Start with one business service or agreed asset scope. Identify cryptographic use, confidentiality needs, and vendor dependencies.

  • Threat model and cryptographic inventory
  • Data lifetime and priorities
  • Vendor support and gap assessment
  • Phased migration roadmap

AcceptanceEach asset has a traceable source, owner, and status. Uncovered areas remain explicit.

Architecture & pilot · Validate a complete path in a controlled environment.

Compare architecture options for a connection or signing use case. Define product support, tests, acceptance criteria, and rollback.

  • Architecture options, trade-offs, and test matrix
  • Compatibility and performance comparison
  • Negotiation or signature test evidence
  • Failure, fallback, and recovery exercises

AcceptanceUse agreed performance and compatibility criteria, with repeatable success and failure tests.

Migration governance · Give every migration batch a reviewable basis.

Use pilot evidence to plan migration batches and review changes, while maintaining assets, dependencies, and exceptions.

  • Rollout plan and responsibility matrix
  • Change review and validation criteria
  • Procurement requirements and exceptions
  • Vendor updates and periodic review

AcceptanceRecommendations trace back to evidence. The customer owns approval and cutover, with open items and owners recorded.

Advisory covers analysis, design, and evidence review. Authorized customer teams and vendors execute production changes; implementation, licenses, and support require an agreed scope.

03 / A FOCUSED PILOT

One scenario. Testable evidence.

Validate the complete connection path.

Check client, proxy, and server versions before evaluating suitable PQC or hybrid key establishment.

What to measure
Negotiation, handshake latency, connection success, and fallback behavior.
Scope consideration
Verify key establishment and certificate signatures separately. Edge support does not establish end-to-end protection.
Websites & APIs · Validate the complete connection path.

Check client, proxy, and server versions before evaluating suitable PQC or hybrid key establishment.

What to measure
Negotiation, handshake latency, connection success, and fallback behavior.
Scope consideration
Verify key establishment and certificate signatures separately. Edge support does not establish end-to-end protection.
Software & document signing · Check signing and verification at every endpoint.

Map signing, verification, and update dependencies, and confirm ML-DSA or SLH-DSA support in specific products.

What to measure
Signature and key size, verification performance, trust chains, and legacy compatibility.
Scope consideration
Long-term validation also depends on certificates, timestamps, and preserved evidence.
Devices & vendor dependencies · Align vendor roadmaps with your plan.

Inventory device, PKI, HSM, and library versions and lifecycles. Confirm implementation scope and upgrade paths.

What to measure
Available versions, protocols, validation scope, licensing, and maintenance cycles.
Scope consideration
A PQC announcement does not confirm support for your model, version, and configuration.

04 / YOUR NEXT MOVE

Find your starting point.

Answer three questions to prepare a scope for your next internal discussion.

No contact details required. Answers are processed on this page and are not submitted by this questionnaire.

Book a discovery meeting

Five years is a questionnaire threshold, not a standard or regulatory deadline.

05 / QUESTIONS

Make the questions clear.

Do we need to replace every system now?

Begin with inventory, prioritization, and vendor checks. Stage replacements with compatibility, performance, and rollback validation.

Does enabling PQC on a website complete the migration?

Check edge-to-origin traffic, internal services, key management, and signing separately. PQC key establishment does not imply migrated certificate signatures.

Does using a NIST algorithm mean certification?

Algorithm standards, implementation correctness, and cryptographic module validation are separate. Check the product, version, and validation scope.

How does PQC differ from steganography and QKD?

PQC uses algorithms on conventional computers to resist known quantum attacks. Steganography hides the presence of information; QKD requires quantum channels and equipment. This service focuses on PQC migration.

How are costs and timelines confirmed?

Confirm assets, applications, test environments, and vendor support, then agree the assessment, pilot, migration, and support scope.

NIST PQC migration project